Terms and conditions

Last updated: 6 November 2026

These terms and conditions apply to the data center and cloud services that Infinity Cloud Technologies S.R.L. provides. Please read them carefully, especially the clauses listed in section 26, which you accept expressly when you accept an Order.

1. About these terms

1.1 These terms and conditions (the “Terms”) apply to all services that Infinity Cloud Technologies S.R.L. (“Infinity Cloud”, “we”, “us”) provides from its data center in Romania, in the European Union, to the customer named in the Order (“you”).

1.2 Our agreement with you (the “Agreement”) is made up of: (a) the Order; (b) any service level agreement or service description that we agree with you; and (c) these Terms, including Schedule 1 (Acceptable use policy), Schedule 2 (Reporting illegal content and abuse) and Schedule 3 (Data processing terms). If they conflict, they apply in that order, except that Schedule 3 takes priority on the processing of personal data.

1.3 Our website terms of use apply to the use of our website. Our privacy policy explains how we handle personal data as a controller.

1.4 Your own terms, for example in a purchase order, do not apply unless we accept them in writing.

2. Definitions

• Customer Data: all data, software, content and other information that you or your Users upload to, store in or process with the Services, including personal data. It does not include Service Data.
• Service Data: data that we generate about the operation of the Services and our infrastructure, such as metering, capacity, monitoring and security logs.
• Dashboard: our client dashboard and its API.
• Order: the order form, accepted quote, order placed in the Dashboard or signed agreement that sets out the Services, fees, term and any special terms.
• Services: the services in the Order, such as AI servers, bare-metal servers, dedicated cloud, cloud servers, cloud databases, cloud security and Kubernetes stacks, together with related support.
• Users: the people you allow to use the Services or the Dashboard.
• Business Day: Monday to Friday, except public holidays in Romania.
• Data Act: Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data.
• GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.

3. Who can use our services

3.1 Our Services are for businesses, public bodies and other organisations, and for people acting for purposes of their trade, business or profession. If you accept these Terms on behalf of an organisation, you confirm that you have authority to bind it.

3.2 There is no public sign-up. We open accounts on request, at our discretion. Before we open an account, and at any time during the Agreement, we may ask for information to verify your identity, your organisation and, where needed, its owners, and check them against EU, UN and other applicable sanctions lists. We may refuse or end the Services if you do not provide this information or the checks fail.

3.3 Keep your account details, billing details and contact persons up to date, including a contact for abuse and security notices.

3.4 If, despite clause 3.1, you are a consumer, nothing in these Terms limits the rights that mandatory consumer law gives you.

4. Orders and the start of the Agreement

4.1 Prices, configurations and specifications on our website are for information only and are not a binding offer. A quote is valid for 30 days unless it says otherwise.

4.2 The Agreement starts when we accept your Order in writing, including by email or by activating the Service in the Dashboard, or when we start providing the Services, whichever comes first.

4.3 Delivery dates are estimates, especially for AI servers and other hardware that depends on manufacturers’ supply. If we cannot deliver within a reasonable time after the estimated date, either of us may cancel the affected Order without liability, and we refund any fees you paid for it.

5. The Services

5.1 We provide the Services as described in the Order, with reasonable skill and care.

5.2 Unless the Order says that a Service is managed, the Services are unmanaged infrastructure. We run and maintain the data center, power, cooling, network and hardware and, where relevant, the virtualisation or platform layer. You are responsible for everything you install and run on the Services, including operating systems, applications, configuration, security updates, firewall rules, access credentials and backups.

5.3 The resources of each Service, such as processors, GPUs, memory, storage and bandwidth, are as set out in the Order. Dedicated resources, such as dedicated vCPUs and bare-metal servers, are reserved for you. Shared resources are subject to fair use, so that one customer cannot degrade the service of others.

5.4 IP addresses that we assign to you remain ours or our registry’s. You may use them only during the Agreement. We may change them with reasonable notice if technical or legal reasons require it.

5.5 We may change and improve the Services. We will not materially reduce the functionality, security or performance of a Service during its committed term, unless the law or security requires it. If a change has a material adverse effect on you, we give you at least 30 days’ notice, and you may terminate the affected Service without penalty before the change takes effect.

5.6 Where we provide third-party software, such as operating system images, its licence terms also apply. You need valid licences for any software that you install yourself.

5.7 All hardware remains our property or our suppliers’ property. You have no right of physical access to the data center or the hardware unless the Order expressly grants it.

6. Service levels, maintenance and support

6.1 Service levels, such as availability targets, response times and service credits, apply only if they are set out in the Order or a service level agreement. Service credits are your only financial remedy for a failure to meet a service level, unless the failure was caused intentionally or by gross negligence.

6.2 We give at least 5 Business Days’ notice, in the Dashboard or by email, of planned maintenance that we expect to interrupt a Service, and we schedule it at times of low use where we can.

6.3 We may carry out urgent maintenance without notice to fix security vulnerabilities, prevent damage or restore service. We tell you as soon as we can.

6.4 We provide support through the Dashboard or by email, during the hours set out in the Order. We do not support your own software unless we agree to.

6.5 We tell you without undue delay about incidents that significantly affect your Services, and we keep you informed until they are resolved.

7. Your responsibilities

7.1 You are responsible for your Users and for all activity under your account, including activity using your API keys.

7.2 Keep your credentials secure, use two-factor authentication where it is available, and tell us immediately if you suspect unauthorised access to your account.

7.3 Comply with the Acceptable use policy in Schedule 1 and with all laws that apply to you and to the Customer Data. You are responsible for the Customer Data, including its lawfulness and your right to use it.

7.4 Keep your own backups of Customer Data, unless you have ordered a backup Service from us.

7.5 Respond promptly to the abuse and security notices we send you, within the time stated in the notice.

7.6 If you develop, train, deploy or use AI systems or models with the Services, you are responsible for complying with the laws that apply to them, including Regulation (EU) 2024/1689 (the AI Act). We provide the computing infrastructure only; we are not the provider or deployer of your AI systems.

7.7 Comply with all export control and sanctions laws that apply to you, including those of the EU. Do not let sanctioned persons use the Services, and do not use the Services, including GPU capacity, for prohibited end uses, such as weapons of mass destruction or military end uses in embargoed countries.

8. Security

8.1 We maintain appropriate technical and organisational measures to protect the Services and the data center. They include physical access control, environmental controls, network protection, secure handling of storage media, confidentiality obligations and training for our staff, logging and monitoring, and incident response procedures. We review them regularly.

8.2 Security is shared between us:

• We secure the data center building, power and cooling, the physical hardware, our network and, where relevant, the virtualisation or platform layer and the Dashboard.
• You secure what you run on the Services: operating systems and software, their updates and configuration, user accounts and credentials, firewall rules, encryption of Customer Data where you need it, and backups.

8.3 Before a storage device that held Customer Data is reused or leaves our control, we securely erase or destroy it using recognised methods.

8.4 To protect our network, other customers and third parties, we may filter or block traffic, for example to mitigate a denial-of-service attack against or from an IP address in your Services.

9. Fees and payment

9.1 The fees are those in the Order or, if the Order does not set them, in our price list when you order. Prices are in euros and exclude VAT and other taxes, which we add where they apply. For business customers in other EU countries, the reverse-charge mechanism may apply.

9.2 Unless the Order says otherwise, we invoice recurring fees monthly in advance, usage-based fees, such as hourly AI servers or extra traffic, monthly in arrears based on our metering, and one-off fees when the Service starts. Our metering records are evidence of usage unless you show that they are wrong.

9.3 Pay each invoice within 14 days of its date, unless the invoice or the Order states otherwise, without deduction or set-off.

9.4 If you pay late, we may charge late-payment interest and recovery costs as Romanian law allows, including Law no. 72/2013 on combating late payment, and suspend the Services under clause 11.

9.5 If you dispute an invoice, tell us in writing within 30 days of receiving it, with your reasons, and pay the part you do not dispute.

9.6 For Services without a committed term, we may change prices with at least 30 days’ notice. If you do not accept a change, you may cancel the affected Service before it takes effect. Prices for a committed term are fixed for that term, except for changes in taxes or as the Order allows.

10. Term, renewal and termination

10.1 Each Service runs for the term in the Order. If the Order sets no term, the Service runs month to month and renews automatically each month until either of us cancels it.

10.2 You may cancel a month-to-month Service at any time in the Dashboard or in writing; it ends at the end of the current billing month. You may stop hourly or on-demand Services at any time, and we bill usage until then.

10.3 When a committed term ends, the Service continues month to month at our current prices unless either of us cancels it, or the Order provides otherwise.

10.4 If you end a committed-term Service early, other than because of our breach, you pay the fees for the rest of the committed term as compensation for the reserved capacity and discount, unless the Order sets a lower early termination fee.

10.5 Either of us may terminate the Agreement or an Order with immediate effect by written notice if the other: (a) materially breaches it and does not remedy the breach within 30 days of written notice; or (b) becomes insolvent or enters insolvency or liquidation proceedings, to the extent the law allows termination for that reason.

10.6 We may also terminate the Agreement or an Order by written notice if: (a) an invoice is more than 30 days overdue after we suspended the Services for non-payment; (b) you seriously or repeatedly breach the Acceptable use policy; (c) continuing would breach sanctions law; or (d) the law or an authority requires it.

10.7 When the Agreement or a Service ends, all fees due for it become payable, and clause 12 applies to your data. Clauses that by their nature continue after the end of the Agreement, such as those on confidentiality, liability and data, remain in force.

11. Suspension

11.1 We may suspend all or part of the Services if: (a) an undisputed invoice is more than 14 days overdue and you have not paid within 7 days of our reminder; (b) you breach the Acceptable use policy; (c) suspension is needed to prevent or stop a security incident, attack or threat to our network, other customers or third parties; (d) a court or public authority orders it; or (e) sanctions law requires it.

11.2 We limit a suspension to what is necessary. We give you notice before suspending where we reasonably can, and always in the case of point (a), and we restore the Services promptly once the reason has been resolved. If a suspension is caused by you, the fees remain payable during it.

11.3 A suspension does not delete Customer Data.

12. Switching, data export and deletion

12.1 You may switch to another provider of data processing services, or move to your own on-premises systems, at any time. This clause sets out how, as required by Chapter VI of the Data Act.

12.2 To start a switch, tell us in writing or in the Dashboard. The maximum notice period is 2 months: in your request, choose the date on which the transitional period starts, which can be any date within 2 months of your request. If you do not choose a date, it starts 14 days after we receive the request.

12.3 The transitional period lasts up to 30 calendar days. During it we: (a) give you reasonable assistance with the switch; (b) act with due care to maintain business continuity, and continue to provide the Services under the Agreement; (c) give you clear information about any known risks to continuity; and (d) maintain a high level of security throughout the process.

12.4 If a 30-day transitional period is technically unfeasible, we tell you within 14 working days of your request, explain why, and propose an alternative transitional period of no more than 7 months. You may extend the transitional period once, for a period you consider more appropriate.

12.5 The data and digital assets you can export are all Customer Data, including input and output data and the metadata generated by your use of the Services, such as virtual machine and disk images, snapshots, files and object storage, database contents, DNS records, and configuration you created in the Dashboard, such as network, firewall and Kubernetes settings.

12.6 The following categories are excluded from export, because they relate to the internal functioning of our services and exporting them would put our trade secrets or security at risk: (a) Service Data; (b) the configuration and code of our infrastructure, platform and Dashboard; and (c) our network topology and security systems.

12.7 We make exportable data available in the formats in which it is stored or in commonly used, machine-readable formats, such as standard disk image formats and database dumps, by secure network transfer or another method we agree. We describe the available procedures, formats and any known technical limitations in our documentation, which we provide on request.

12.8 After the transitional period, you have a further 30 calendar days to retrieve your data.

12.9 When that retrieval period ends, or earlier if you ask once the switch is complete, we erase all exportable data and digital assets that you generated, and confirm this in writing if you ask.

12.10 The Agreement, or the Services concerned, ends when the switch has been completed successfully, and we tell you so. If you do not want to switch but want your data erased when the Services end, the Agreement ends at the end of the notice period.

12.11 We do not charge switching charges, including data egress charges for switching. You pay the normal fees for the Services you use during the notice and transitional periods.

12.12 When a Service ends for any reason other than switching, we keep the Customer Data in it for 30 days so that you can retrieve it, unless the law requires faster deletion, and then we delete it. If the Service ended because of a serious breach of the Acceptable use policy, we may restrict access to that data while keeping it for any period that the law or an authority requires.

12.13 If a Service has been custom-built for you and is not offered at broad commercial scale, or is provided only for testing and evaluation for a limited period, the Order may set different switching terms, as far as the Data Act allows.

13. Location of your data and government access

13.1 We store Customer Data in our data center in Romania, in the European Union. We do not move it to another country without your instructions. Infinity Cloud and the infrastructure that runs the Services are subject to Romanian and EU law.

13.2 We do not give our parent company or other group companies access to Customer Data.

13.3 We disclose Customer Data to a public authority only when EU or Member State law requires it. When we receive a request, we check that it is lawful, challenge it if we consider it unlawful or too broad, disclose only the minimum required, and tell you before disclosing unless the law prohibits it.

13.4 We comply with a request from a court or authority outside the EU for access to, or transfer of, non-personal Customer Data only if it is based on an international agreement, or if it otherwise meets the conditions of Article 32 of the Data Act. Our measures against unlawful access include physical and logical access controls, access for our staff only where needed, and the ability for you to encrypt Customer Data with keys that we do not hold.

14. Customer Data and intellectual property

14.1 You keep all rights in Customer Data. You allow us to host, store, copy, transmit and otherwise process it only as needed to provide the Services, to comply with the law and to enforce the Agreement.

14.2 We do not access the contents of Customer Data, except: (a) at your request, for example for support; (b) when needed to provide or secure the Services; (c) to investigate a notice of illegal content or a suspected breach of the Acceptable use policy; or (d) when the law requires it.

14.3 We do not use Customer Data to train AI models or for advertising, and we do not sell it.

14.4 We own Service Data and may use it to run, secure, improve and bill the Services. If we use it for any other purpose, we make sure it does not identify you or any individual.

14.5 The Services, the Dashboard, our documentation and our brand belong to us or our licensors. During the Agreement, you may use them for your business, under these Terms; this right is non-exclusive and non-transferable.

14.6 If you give us feedback or suggestions, we may use them freely, without any obligation to you.

15. Data protection

15.1 When we process personal data in Customer Data on your behalf, you are the controller (or a processor acting for a controller) and we are your processor (or sub-processor). Schedule 3 applies and is the agreement that Article 28 of the GDPR requires.

15.2 We are the controller of the personal data of your contact persons and Users that we process for account management, billing, security and legal compliance, as described in our privacy policy.

16. Confidentiality

16.1 Each of us keeps confidential the non-public information that the other discloses under the Agreement, uses it only for the Agreement, and discloses it only to employees, advisers and subcontractors who need to know it and are bound by confidentiality obligations.

16.2 This does not apply to information that is or becomes public through no fault of the receiving party, that it already had or develops independently, or that it must disclose by law. In that last case, it tells the other party first where the law allows.

16.3 These obligations continue for 3 years after the Agreement ends, and for as long as the information remains a trade secret. Customer Data stays confidential without time limit.

17. Warranties

17.1 Each of us confirms that it has the right and authority to enter into the Agreement.

17.2 Apart from what the Agreement expressly states, and to the extent the law allows, we give no other warranties. In particular, we do not promise that the Services will be uninterrupted or error-free, or that they will be suitable for a particular purpose that is not set out in the Order.

18. Liability

18.1 Nothing in the Agreement limits or excludes liability for damage caused intentionally or by gross negligence, for death or personal injury, or any other liability that cannot be limited or excluded by law.

18.2 Neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, business, goodwill or anticipated savings.

18.3 We are not liable for the loss or corruption of Customer Data, except to the extent that it results from our breach of our security obligations. In that case, our liability is limited to the reasonable cost of restoring the data from your most recent backup.

18.4 Each party’s total liability in each contract year is limited to the total fees paid and payable by you under the Agreement in the 12 months before the event that gave rise to the claim. Service credits count towards this limit. The limit does not apply to your obligation to pay fees or to your obligations under clause 19.

19. Claims relating to Customer Data

19.1 You will compensate us for claims by third parties, fines and reasonable costs that arise from Customer Data or from your or your Users’ use of the Services in breach of the Agreement or the law, except to the extent they are caused by our breach.

19.2 We will tell you promptly about any such claim and let you take part in its defence.

20. Force majeure

20.1 Neither of us is liable for a delay or failure caused by an event beyond its reasonable control that it could not reasonably have foreseen or avoided, such as natural disasters, war, terrorism, epidemics, actions of public authorities, widespread failures of public power grids or telecommunications networks, and large-scale cyberattacks that the precautions expected of a professional data center operator could not have prevented. Failures that our redundant systems are designed to absorb are not force majeure.

20.2 The affected party tells the other promptly and does what it reasonably can to limit the effects. If the event lasts more than 30 days, either of us may terminate the affected Services by written notice.

20.3 Force majeure does not excuse the payment of fees, except fees for Services that we could not provide.

21. Changes to these Terms

21.1 We may change these Terms. We give you at least 30 days’ notice of material changes by email or in the Dashboard. If you object to a change, you may terminate the affected Services without penalty, even during a committed term, before the change takes effect.

21.2 Changes that the law requires, or that are needed urgently for security, may take effect sooner. We tell you about them as soon as we can.

22. Subcontractors and assignment

22.1 We may use subcontractors, including our group companies, to provide the Services, and we remain responsible for them. Schedule 3 governs the use of sub-processors.

22.2 You may not transfer the Agreement without our written consent. We may transfer it to a group company or to a buyer of our business, with notice to you, provided your rights are not reduced.

23. Notices

23.1 We send operational notices, such as maintenance and incident notices, by email to your account contacts or in the Dashboard.

23.2 Legal notices, such as notices of breach, termination or claims, must be in writing and sent by email to the other party’s designated contact. Notices to us go to infoinfinitycloud.io. A notice terminating the Agreement must also be sent by courier or registered post to the other party’s registered office; ours is at Spl. Independenței 319L, Clădirea Paris, etaj 1, camera 01, Sector 6, Bucharest, Romania.

24. Governing law and disputes

24.1 The Agreement is governed by Romanian law. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

24.2 Before going to court, we will both try in good faith to settle a dispute within 30 days of a written notice describing it.

24.3 The courts of Bucharest, Romania, have exclusive jurisdiction. Either of us may still ask any competent court for urgent interim measures.

25. General

25.1 The Agreement is the entire agreement between us on its subject and replaces any earlier agreements, proposals and statements about it.

25.2 If a court finds any part of the Agreement invalid, the rest remains in force, and we will replace the invalid part with a valid one that comes as close as possible to its purpose.

25.3 If either of us does not enforce a right, that is not a waiver of it.

25.4 We are independent contractors. The Agreement creates no partnership, agency or employment relationship, and it gives no rights to third parties.

25.5 These Terms are written in English. If we give you a translation, the English version prevails, unless mandatory law requires otherwise.

26. Express acceptance of standard clauses

26.1 Under Article 1203 of the Romanian Civil Code, certain standard clauses take effect only if they are expressly accepted in writing. By signing or accepting the Order, you expressly accept the following clauses: 5.5 (changes to the Services); 6.1 (service credits as the only remedy); 9.4 and 9.6 (late payment and price changes); 10.1, 10.3, 10.4 and 10.6 (automatic renewal, early termination fee and our right to terminate); 11 (suspension); 12.12 (restricting access after a serious breach); 18 (liability); 21 (changes to these Terms); 22.2 (transfer of the Agreement); and 24 (governing law and courts).

Schedule 1: Acceptable use policy

S1.1 This policy applies to you, your Users and anyone else you allow to use the Services, including your own customers. You are responsible for making sure that they comply with it.

S1.2 You must not use the Services to:

• (a) store, send or publish illegal content, including child sexual abuse material, terrorist content, content that incites violence or hatred, and content that infringes intellectual property or privacy rights
• (b) send unsolicited bulk messages (spam), run open mail relays, or host websites that are promoted by spam
• (c) carry out phishing, fraud or scams, or distribute malware, ransomware or botnet control software
• (d) attack, probe, scan or test the vulnerability of systems or networks without their owner’s permission, including by denial-of-service attacks, or forge network headers or IP addresses
• (e) gain or attempt unauthorised access to accounts, systems or data
• (f) run open proxies, open DNS resolvers or other services that third parties can easily abuse
• (g) mine cryptocurrency, unless the Order expressly allows it
• (h) breach sanctions or export control laws, or provide services to sanctioned persons
• (i) interfere with the Services, our network or other customers
• (j) run systems whose failure could lead to death, personal injury or serious environmental damage, such as nuclear facilities, air traffic control or life-support systems, unless we agree to it in writing

S1.3 If you send email from the Services, comply with the law on electronic communications, including Romanian Law no. 506/2004, and keep a working way for recipients to unsubscribe. We may block outgoing email on port 25 by default and open it on request.

S1.4 Keep your systems updated and secure. If a system of yours is compromised and is used to harm others, you must fix it promptly.

S1.5 If you resell the Services or let third parties use them, you remain responsible for them and must pass on the rules in this policy.

S1.6 We enforce this policy proportionately. Depending on the seriousness of the breach, we may ask you to fix it, restrict part of a Service (for example by blocking an IP address or a port), suspend the Services under clause 11, or terminate them under clause 10.6. Where the law requires it, for example for child sexual abuse material, we report illegal activity to the competent authorities.

Schedule 2: Reporting illegal content and abuse

This schedule explains how we handle notices of illegal content and abuse, as the EU Digital Services Act (Regulation (EU) 2022/2065) requires of hosting services.

S2.1 Anyone can tell us about content or activity on our Services that they believe is illegal or breaches our Acceptable use policy. Email infoinfinitycloud.io with “Abuse report” in the subject, or use our contact form.

S2.2 To help us act quickly, a notice should include: (a) why you believe the content or activity is illegal; (b) where it is, such as the exact URL, IP address, time stamps or logs; (c) your name and email address, except for reports of child sexual abuse material and similar offences, which may be anonymous; and (d) a statement that you believe in good faith that the information in your notice is accurate and complete.

S2.3 If you give us an email address, we confirm that we received your notice. We assess each notice in a timely, careful, objective and non-arbitrary way, and tell you what we decided and how you can challenge the decision.

S2.4 As an infrastructure provider, we usually cannot see or remove individual items on our customers’ servers. We therefore normally forward a notice to the customer concerned, without your name or email address, and ask them to deal with it within a set time. If they do not, or if the matter is serious or urgent, we may restrict access to the service concerned, for example by blocking an IP address or suspending a server. Our staff review every notice and make every decision; we do not use automated decision-making to restrict content. We act diligently and proportionately, with due regard to the rights of everyone involved, including freedom of expression.

S2.5 If we restrict your Services because of illegal content or a breach of the Acceptable use policy, we tell you the reasons, unless the law prevents it. You can ask for the decision to be reviewed by replying to us at infoinfinitycloud.io, and you can also go to court.

S2.6 Our single point of contact for EU and national authorities, and for users of our Services, is infoinfinitycloud.io. You can write to us in English or Romanian. We comply with orders from competent authorities to act against illegal content or to provide information, and tell them what we did.

S2.7 If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to the life or safety of people has taken place, is taking place or is likely to take place, we inform the competent law enforcement or judicial authorities.

S2.8 We may stop processing notices from people who frequently submit notices that are clearly unfounded, after warning them.

Schedule 3: Data processing terms

This schedule is the data processing agreement required by Article 28(3) of the GDPR. It applies when we process personal data on your behalf as part of the Services (“Customer Personal Data”).

S3.1 Roles. You are the controller of Customer Personal Data, or a processor acting for a controller. We are your processor, or your sub-processor.

S3.2 Details of the processing.

• Subject matter and duration: providing the Services, for the term of the Agreement and the data retrieval period in clause 12.
• Nature and purpose: hosting, storage, computing and network transmission of Customer Data, backups if you order them, and the technical support you ask for.
• Types of personal data and categories of data subjects: decided by you, depending on what you store and process with the Services. This may include special categories of personal data if you choose to store them; in that case, you are responsible for deciding whether the Services and your own measures are suitable.
• Location: our data center in Romania, in the European Union.

S3.3 Instructions. We process Customer Personal Data only on your documented instructions: the Agreement, your configuration of the Services and your other written instructions. If EU or Member State law requires us to process it otherwise, we tell you first, unless that law prohibits it. We tell you if we believe an instruction infringes data protection law.

S3.4 Confidentiality. Everyone we authorise to process Customer Personal Data is bound by confidentiality.

S3.5 Security. We take the measures required by Article 32 of the GDPR for the parts of the Services we control, including those described in clause 8. You are responsible for securing what you run on the Services, as set out in clause 8.2.

S3.6 Sub-processors. You give us general authorisation to use sub-processors. Our current sub-processors are listed in the Order or available on request. We tell you at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve your objection, you may terminate the affected Services without penalty before the change takes effect. We impose the same data protection obligations on each sub-processor by contract, and we remain liable to you for their performance.

S3.7 Assistance. Taking into account the nature of the processing, we help you with appropriate technical and organisational measures to answer requests from data subjects, and with your obligations under Articles 32 to 36 of the GDPR (security, breach notifications, data protection impact assessments and prior consultation), using the information available to us. In self-service Services, you can access, change and delete Customer Personal Data directly. We may charge reasonable costs for assistance that goes beyond what the Services include.

S3.8 Personal data breaches. We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We give you the information we have about its nature, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed, and update it as we learn more.

S3.9 Deletion or return. When the Services end, you can retrieve Customer Personal Data as described in clause 12. After that, we delete it, unless EU or Member State law requires us to keep it.

S3.10 Audits. We make available to you the information needed to demonstrate compliance with this schedule and Article 28 of the GDPR, and allow audits, including inspections, by you or an independent auditor you appoint. Audits require at least 30 days’ notice, take place during business hours, no more than once a year unless a breach or a supervisory authority makes another one necessary, and are subject to confidentiality. They must not give access to other customers’ data or put the security of our services at risk. You bear the costs of the audit.

S3.11 International transfers. We do not transfer Customer Personal Data outside the European Economic Area unless you instruct us to or EU or Member State law requires it. Any such transfer is made with a safeguard required by Chapter V of the GDPR, such as the European Commission’s standard contractual clauses.

S3.12 Your responsibilities. You are responsible for having a legal basis for the processing, for informing data subjects, and for making sure your instructions comply with the law.

S3.13 Liability and priority. Clause 18 applies to this schedule, to the extent Article 82 of the GDPR allows. If this schedule conflicts with the rest of the Agreement on the processing of personal data, this schedule takes priority.